From f9d561d40ba92461d1b2308a4bb931576b605c9d Mon Sep 17 00:00:00 2001 From: KernelDeimos Date: Mon, 22 Apr 2024 23:48:37 -0400 Subject: [PATCH] docs: document purpose of scary-looking token --- packages/backend/src/services/auth/Actor.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/packages/backend/src/services/auth/Actor.js b/packages/backend/src/services/auth/Actor.js index 899e62a36..9feb165e6 100644 --- a/packages/backend/src/services/auth/Actor.js +++ b/packages/backend/src/services/auth/Actor.js @@ -21,8 +21,14 @@ const { Context } = require("../../util/context"); const { get_user, get_app } = require("../../helpers"); // TODO: add these to configuration; production deployments should change these! + +// THIS IS NOT A LEAK +// We use this to obscure user UUIDs, as some APIs require a user identifier +// for abuse prevention. However, there are no services in selfhosted Puter +// that currently make use of this, and we use different values on `puter.com`. const PRIVATE_UID_NAMESPACE = '1757dc3f-8f04-4d77-b939-ff899045696d'; const PRIVATE_UID_SECRET = 'bf03f0e52f5d93c83822ad8558c625277ce3dddff8dc4a5cb0d3c8493571f770'; +// THIS IS NOT A LEAK (see above) class Actor extends AdvancedBase { static MODULES = {